Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
vllm API endpoints vulnerable to Denial of Service Attacks CVE-2025-48956, GHSA-rxc4-3w6r-4v47, PYSEC-2026-2021 | High | 0.6% | 21 Aug, 2025 | PyPI vllm |
Malicious release: Malicious code in etherweb3 (PyPI) MAL-2025-47764 | Malicious | Not scored | 21 Aug, 2025 | PyPI etherweb3 |
Malicious release: Malicious code in django-aerospike-sessions (PyPI) MAL-2025-47758 | Malicious | Not scored | 21 Aug, 2025 | PyPI django-aerospike-sessions |
Malicious release: Malicious code in medoen (PyPI) MAL-2025-47786 | Malicious | Not scored | 21 Aug, 2025 | PyPI medoen |
Malicious release: Malicious code in pacakegenow (PyPI) MAL-2025-47793 | Malicious | Not scored | 21 Aug, 2025 | PyPI pacakegenow |
Malicious release: Malicious code in woowoowo (PyPI) MAL-2025-47812 | Malicious | Not scored | 21 Aug, 2025 | PyPI woowoowo |
Malicious release: Malicious code in k7eeel (PyPI) MAL-2025-47776 | Malicious | Not scored | 21 Aug, 2025 | PyPI k7eeel |
Malicious release: Malicious code in k7eela (PyPI) MAL-2025-47778 | Malicious | Not scored | 21 Aug, 2025 | PyPI k7eela |
Malicious release: Malicious code in k7eel2-ss (PyPI) MAL-2025-41421 | Malicious | Not scored | 21 Aug, 2025 | PyPI k7eel2-ss |
Malicious release: Malicious code in cffi-curl (PyPI) MAL-2025-47752 | Malicious | Not scored | 20 Aug, 2025 | PyPI cffi-curl |
Malicious release: Malicious code in my-first-pypi-demo (PyPI) MAL-2025-191651 | Malicious | Not scored | 20 Aug, 2025 | PyPI my-first-pypi-demo |
Malicious release: Malicious code in python-amazon-doc-utils (PyPI) MAL-2025-47796 | Malicious | Not scored | 20 Aug, 2025 | PyPI python-amazon-doc-utils |
Malicious release: Malicious code in hashstation (PyPI) MAL-2025-191749 | Malicious | Not scored | 20 Aug, 2025 | PyPI hashstation |
Malicious release: Malicious code in nukecount (PyPI) MAL-2025-47790 | Malicious | Not scored | 20 Aug, 2025 | PyPI nukecount |
Malicious release: Malicious code in randar303 (PyPI) MAL-2025-47800 | Malicious | Not scored | 20 Aug, 2025 | PyPI randar303 |
Malicious release: Malicious code in buildpeople (PyPI) MAL-2025-47751 | Malicious | Not scored | 20 Aug, 2025 | PyPI buildpeople |
Malicious release: Malicious code in noonutil (PyPI) MAL-2025-47788 | Malicious | Not scored | 20 Aug, 2025 | PyPI noonutil |
Malicious release: Malicious code in k7eel (PyPI) MAL-2025-47777 | Malicious | Not scored | 20 Aug, 2025 | PyPI k7eel |
Withdrawn Advisory: Microsoft Knack ReDoS Vulnerability in the Introspection Module CVE-2025-54364, GHSA-xh9h-692f-mmg4 | Medium | 0.4% | 20 Aug, 2025 | PyPI knack |
Withdrawn Advisory: Microsoft Knack ReDoS Vulnerability in the Introspection Module CVE-2025-54363, GHSA-6fxp-p9mg-q64w | Medium | 0.4% | 20 Aug, 2025 | PyPI knack |
Malicious release: Malicious code in tronlinknet (PyPI) MAL-2025-191912 | Malicious | Not scored | 19 Aug, 2025 | PyPI tronlinknet |
Malicious release: Malicious code in tronwalletpy (PyPI) MAL-2025-47809 | Malicious | Not scored | 19 Aug, 2025 | PyPI tronwalletpy |
Malicious release: Malicious code in caas-jupyter-tools (PyPI) MAL-2025-191697 | Malicious | Not scored | 19 Aug, 2025 | PyPI caas-jupyter-tools |
Malicious release: Malicious code in binance-sdk-ebate (PyPI) MAL-2025-47747 | Malicious | Not scored | 18 Aug, 2025 | PyPI binance-sdk-ebate |
Malicious release: Malicious code in flatfox-api-python (PyPI) MAL-2025-6973 | Malicious | Not scored | 18 Aug, 2025 | PyPI flatfox-api-python |
Copier's safe template has filesystem write access outside destination path CVE-2025-55214, GHSA-p7q8-grrj-3m8w, PYSEC-2026-1273 | Medium | 0.3% | 18 Aug, 2025 | PyPI copier |
Copier's safe template has arbitrary filesystem read/write access CVE-2025-55201, GHSA-3xw7-v6cj-5q8h, PYSEC-2026-1271 | High | 0.3% | 18 Aug, 2025 | PyPI copier |
Malicious release: Malicious code in svcmanagement (PyPI) MAL-2025-47801 | Malicious | Not scored | 18 Aug, 2025 | PyPI svcmanagement |
Malicious release: Malicious code in swiv (PyPI) MAL-2025-6897 | Malicious | Not scored | 18 Aug, 2025 | PyPI swiv |
Malicious release: Malicious code in flask-tdg-cyberx (PyPI) MAL-2025-191732 | Malicious | Not scored | 17 Aug, 2025 | PyPI flask-tdg-cyberx |
Malicious release: Malicious code in pytensorlite (PyPI) MAL-2025-47795 | Malicious | Not scored | 17 Aug, 2025 | PyPI pytensorlite |
Malicious release: Malicious code in titifel-pyip (PyPI) MAL-2025-47803 | Malicious | Not scored | 15 Aug, 2025 | PyPI titifel-pyip |
Malicious release: Malicious code in libgomp (PyPI) MAL-2025-47783 | Malicious | Not scored | 15 Aug, 2025 | PyPI libgomp |
Malicious release: Malicious code in iamenumerate (PyPI) MAL-2025-41688 | Malicious | Not scored | 14 Aug, 2025 | PyPI iamenumerate |
Malicious release: Malicious code in jsonist (PyPI) MAL-2025-191767 | Malicious | Not scored | 14 Aug, 2025 | PyPI jsonist |
Withdrawn Advisory: Python-Future Module Arbitrary Code Execution via Unintended Import of test.py CVE-2025-50817, GHSA-xqrq-4mgf-ff32 | High | 0.3% | 14 Aug, 2025 | PyPI future |
Malicious release: Malicious code in titifel-pypi (PyPI) MAL-2025-47804 | Malicious | Not scored | 14 Aug, 2025 | PyPI titifel-pypi |
Malicious release: Malicious code in browser-run (PyPI) MAL-2025-191696 | Malicious | Not scored | 14 Aug, 2025 | PyPI browser-run |
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access BIT-superset-2025-55675, CVE-2025-55675, GHSA-mhpq-m962-mg92, PYSEC-2026-1186 | Medium | 0.6% | 14 Aug, 2025 | PyPI apache-superset |
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions BIT-superset-2025-55674, CVE-2025-55674, GHSA-fxgf-3xh6-m2pp, PYSEC-2026-1178 | Medium | 0.7% | 14 Aug, 2025 | PyPI apache-superset |
Apache Superset data query improperly discloses database schema information to low-privileged guest user BIT-superset-2025-55673, CVE-2025-55673, GHSA-9g5x-mm39-wg9r, PYSEC-2026-1169 | Medium | 0.6% | 14 Aug, 2025 | PyPI apache-superset |
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability BIT-superset-2025-55672, CVE-2025-55672, GHSA-fj97-2v9x-w5m4, PYSEC-2026-1176 | Medium | 0.7% | 14 Aug, 2025 | PyPI apache-superset |
PyPDF's Manipulated FlateDecode streams can exhaust RAM CVE-2025-55197, GHSA-7hfw-26vp-jp8m, PYSEC-2026-1830 | Medium | 0.5% | 13 Aug, 2025 | PyPI pypdf |
Malicious release: Malicious code in st-py-de-cli (PyPI) MAL-2025-41768 | Malicious | Not scored | 13 Aug, 2025 | PyPI st-py-de-cli |
OMERO.web displays unecessary user information when requesting password reset CVE-2025-54791, GHSA-gpmg-4x4g-mr5r, PYSEC-2026-1717 | Medium | 0.3% | 13 Aug, 2025 | PyPI omero-web |
Malicious release: Malicious code in pycrackhash (PyPI) MAL-2025-191832 | Malicious | Not scored | 13 Aug, 2025 | PyPI pycrackhash |
Malicious release: Malicious code in iamenumer (PyPI) MAL-2025-41687 | Malicious | Not scored | 12 Aug, 2025 | PyPI iamenumer |
Malicious release: Malicious code in aws-enumerate (PyPI) MAL-2025-41621 | Malicious | Not scored | 12 Aug, 2025 | PyPI aws-enumerate |
Malicious release: Malicious code in kertash (PyPI) MAL-2025-191774 | Malicious | Not scored | 12 Aug, 2025 | PyPI kertash |
Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass CVE-2025-71325, GHSA-9gvj-pp9x-gcfr, PYSEC-2026-1788 | Critical | 0.6% | 12 Aug, 2025 | PyPI picklescan |